Per https://review.openstack.org/#/c/196893/
Instead of running
in the qrouter namespace, keepalived will run inside
the snat-namespace. Therefore only snat ports will
fall under the control of the HA domain.